Harden the release workflow: SHA-pin the publisher, smoke the artifacts - #130
Merged
Conversation
Three pre-release hardenings: - pypa/gh-action-pypi-publish is the one action holding OIDC publishing authority, so it is pinned to a full commit SHA (ba38be9e461d3875417946c167d0b5f3d385a247 = v1.14.1) rather than the mutable release/v1 branch; bumping it is now a deliberate act. - A smoke job between build and publish installs BOTH freshly built artifacts (wheel and sdist) into clean virtual environments, imports the package and runs pip check -- an artifact that cannot even install fails before anything reaches PyPI. (Both steps verified locally against a fresh build: import ok, no broken requirements.) - The one-time-setup notes now firmly recommend a required reviewer on the pypi environment -- publishing then always takes a second, deliberate approval after the tag push -- instead of mentioning reviewers as optional. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pre-release hardening of
release.yml, per review:pypa/gh-action-pypi-publishholds the OIDC publishing authority, so it's now pinned to a full commit SHA (ba38be9e…= v1.14.1, verified against the action repo's tags) instead of the mutablerelease/v1branch. Bumping it becomes a deliberate, reviewable act.pip check;publishnowneeds: [build, smoke]. An artifact that can't install fails before anything reaches PyPI. Both steps verified locally against a fresh build (whl ok: 1.0.0rc1,tar.gz ok: 1.0.0rc1, no broken requirements).pypienvironment (publish = tag push plus a deliberate approval click), rather than mentioning reviewers as optional. The environment setting itself remains a repository-settings step only a maintainer can do.No trigger or flow changes otherwise; the tag-vs-version guard from #113 is untouched. Should land before
v1.0.0rc1is published so the rehearsal exercises the final workflow.🤖 Generated with Claude Code